cloud-logging-configuration-basics

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha da8575416ea1 · 31 Oct 2026Report an issue or request a re-scan

• Publishergoogle GitHub organizationOwner of the repository this skill is read from
• Source foldergoogle/skills/skills/cloud/cloud-logging-configuration-basicsThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdictda8575416ea1A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Configure single-project Cloud Logging on Google Cloud: regional log buckets, log sinks, log views, restricting or hiding sensitive logs in the default view (_Default) filter, IAM permissions for views (Logs View…

---
name: cloud-logging-configuration-basics
description: >-
  Configure single-project Cloud Logging on Google Cloud: regional log buckets, log sinks, log views, restricting or hiding sensitive logs in the default view (_Default) filter,
  IAM permissions for views (Logs View Accessor, IAM conditions), logs-based metrics, log exclusions, and sampling.
  Don't use for cross-project logging or multi-project setups.
metadata:
  version: "1.0.2"
  category: CloudObservabilityAndMonitoring
---

# Configuring Cloud Logging

Use this skill to configure Cloud Logging resources such as log buckets, log
views, or log sinks.

> [!IMPORTANT] **Sandbox Network Limitation (CRITICAL for Agent Testing):**
> During evaluation or in restricted sandboxed environments, network traffic to
> Google Cloud APIs is blocked. Do **NOT** run network discovery commands to
> find resource names, project IDs, or organization IDs. Always use the exact
> project IDs or placeholders provided in the user prompt or instructions for
> example, `{project_id}`. Assume these resources exist and proceed directly
> with configuration commands. Running these discovery commands will cause the
> execution to hang and timeout.

## Attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
MUST read [Usage Attribution](references/attribution.md). For commands executed
directly in the terminal (never in generated scripts, Terraform, or user code),
prefix `gcloud` with
`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:cloud-logging-configuration-basics)"`
and append `agent-skills/1.0 (skill:cloud-logging-configuration-basics)` to `User-Agent` headers.

## Safety and Confirmation Tiers (CRITICAL)

Before executing any commands on behalf of the user, you MUST adhere to the
following safety tiers based on the action requested:

1.  **Tier R: Read-Only**
    *   **Description:** Commands that only read state or query logs.
    *   **Example commands:**
        *   `gcloud logging read`
        *   `gcloud logging buckets list`
    *   **Rule:** No confirmation needed. You may execute these commands
        immediately to gather information.
2.  **Tier M: Mutation (Non-Billing)**
    *   **Description:** Configuration modifications or free metadata creations
        that do not incur direct storage or billing costs and do not affect
        resource security/access policies.
    *   **Example commands:**
        *   `gcloud logging views create`
        *   `gcloud logging views update`
        *   `gcloud logging scopes create`
        *   `gcloud logging buckets create`
    *   **Rule:** No confirmation needed. You may execute these commands
        immediately to apply configurations.
3.  **Tier B: Billing and Security-Sensitive Mutations (High-Risk)**
    *   **Description:** Operations that create billing-inducing resources or
        integrations, or modify security and IAM access control policies
        (presenting a risk of privilege escalation).
    *   **Example commands:**
        *   `gcloud logging metrics create`
        *   `gcloud logging links create`
        *   `gcloud projects add-iam-policy-binding`
    *   **Rule:** **Interactive confirmation required.** These commands create
        resources that incur billing costs or alter security access. You MUST
        present the exact, literal command and receive user confirmation before
        executing. NEVER execute in the same turn as asking.
4.  **Tier D: Causes irreversible data loss**
    *   **Description:** Actions that permanently discard or delete logs, for
        example sink exclusions.
    *   **Example commands:**
        *   `gcloud logging buckets delete`
        *   `gcloud logging sinks update --add-exclusion`
    *   **Rule:** **Explicit typed confirmation required.** These commands
        discard or delete logs immediately and irreversibly, or they may result
        in log data not being stored. You MUST ask for explicit typed
        confirmation, for example, "Yes, discard logs", and halt execution until
        the user replies.

## Getting Started

If the `gcloud` executable is missing, refer to the
[Google Cloud CLI Installation Guide](https://docs.cloud.google.com/sdk/docs/install-sdk.md.txt)
to install it.

## Creating Log Buckets (Compliance and Analytics) (Tier M)

To create a regional log bucket with a specific retention policy for regulatory
compliance, and with Observability Analytics enabled:

> [!WARNING] **Mandatory Observability Analytics Downgrade Warning:** Whenever
> providing guidance, writing a guide, or drafting commands on Cloud Logging
> cost optimization or exclusions, you **must** explicitly include the following
> warning in your final text response and any generated guides: "After a log
> bucket has been upgraded to use Observability Analytics, it **cannot be
> downgraded** to remove the analytics capability."

```bash
gcloud logging buckets create {bucket_id} \
    --project={project_id} \
    --location={region} \
    --retention-days={retention_days} \
    --enable-analytics
```

*   `{bucket_id}`: for example, `my-custom-bucket`
*   `{region}`: for example, `us-central1`. You must use a regional log bucket
    to also use Observability Analytics.
*   `{retention_days}`: for example, `365`

A log bucket incurs no storage or ingestion charges until logs are routed to it
with a log sink.

### Verify the Log Bucket (Tier R)

Check the log bucket's configuration to verify its compliance:

```bash
gcloud logging buckets describe {bucket_id} \
    --location={region} \
    --project={project_id}
```

### Route logs to the Log Bucket (Tier B)

> [!IMPORTANT] **Billing Action (Tier B):** Routing log entries to a bucket
> incurs ongoing charges based on the volume of data stored. You MUST get
> interactive user confirmation before running this command.

Log entries are stored in the log bucket only if a log sink filter matches the
entries and targets that bucket.

To route log entries 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/google/skills
git -C skills checkout da8575416ea1

Works in

1. 2026-10-31
   ✓SAFE B 89 / 100

   first audit · source da8575416ea1

Questions about cloud-logging-configuration-basics

• github.com/google/skills/tree/main/skills/cloud/cloud-logging-co — the audited source at commit da8575416ea1 and every finding aboveObserved · 31 Oct 2026

Spotted something wrong? Report a correction · Methodology